CVE-2026-96549
Deferred Deferred - Pending Action

Cleartext Credential Storage in Sfturing Hosp Order

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulDB

Description
A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96549
EUVD
EUVD-2026-85569

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sfturing hosp_order to 627f426331da8086ce8fff2017d65b1ddef384f8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-310 Cryptographic Issues

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96549 is a vulnerability in the hosp_order application where registration passwords and password-reset verification codes are stored in cleartext in application logs. The issue occurs because the application logs sensitive user data, including raw passwords before MD5 hashing and four-digit verification codes, via Logback appenders. These logs are stored in files and standard output, making secrets accessible to anyone with log file access.

Detection Guidance

Check application logs for cleartext passwords or verification codes. Inspect ${catalina.base}/logs/log.log and standard output for sensitive data. Search for lines containing 'password' or 'verification code' in logs.

Impact Analysis

An attacker with access to log files could recover passwords and reset codes to gain unauthorized access to user accounts. This could lead to account compromise, data breaches, or further exploitation of the system. The vulnerability is exploitable only from a local environment but poses significant risk if logs are exposed through aggregation systems, backups, or support bundles.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for protecting sensitive personal data. Storing passwords and verification codes in cleartext in logs exposes personal information, which could result in non-compliance with data protection regulations, leading to legal penalties and reputational damage.

Mitigation Strategies

Remove all secret logging immediately. Redact sensitive parameters at logging boundaries. Restrict log access and retention. Rotate potentially exposed credentials and reset codes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96549. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart